Make SimpleMetrics thread-safe

SimpleMetrics stores timers in a plain TreeMap and the inline Timer has unsynchronized start/stop/value. Engine.Builder.withMetrics(...) lets callers pass in a shared instance, so this is a footgun — and the Go OPA metrics package locks per-timer plus the outer map (see https://github.com/open-policy-agent/opa/blob/main/v1/metrics/metrics.go), so the precedent is to be safe by default.

• Guard the timer/counter/histogram maps (e.g., ConcurrentHashMap).
• Synchronize Timer.start/stop/value (or use AtomicLong for the accumulated value).
• Use AtomicLong / LongAdder for Counter.
• Add a concurrency test that exercises a shared Metrics from multiple threads.

Start by reading SimpleMetrics, its inline Timer, and the Engine.Builder.withMetrics(...) entry point. Compare the timer, counter, histogram, and map access patterns with the linked OPA metrics precedent, then add the requested concurrency test for a shared Metrics instance. Done means concurrent use is safe and the test passes.